capistrano-unicorn-nginx 4.2.0 → 5.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8f0337593e08e19cab15ce29f6ccb7455e37df5e
-  data.tar.gz: 8eba038b8b6e113d3e8be52f8838c14e3232fea4
+  metadata.gz: 0fa877d749e83b2c34f3b32afe592b02e64c5e2a
+  data.tar.gz: 548a8d063c482223211352b23f9448abc49346c8
 SHA512:
-  metadata.gz: 207b3ae7e01925fb55b881e18188b4c8c8b939cf874d2c1b6f2228c1957f975d97d95a926e637e10bcf2b563c804492b507f5dc9691c7ac5ebfd647b61c2d636
-  data.tar.gz: b801c70fc857c355b81444fbac9e5206719444107acf0aa0840a1bc68bd00f011c40e86885241e5b0660bc856c00f653cd84ce32d6ae87ef22063452e0c008d1
+  metadata.gz: 5b74ee7655764aa5b1b377fd780d62c6e08ad9a4f3b21cd1c224a81b64d114aaeaaf58c490e09fda1faca0de4f7727a55d5af2eda137449c1e147ab8b226bb19
+  data.tar.gz: e05853236f43bb5d13b33604f5cffc6b8dfc31af551ecc1e4c18cbb9b7d4071428cb0a9757bf8fd45487594b298af1c4eadfc2b83fdc1d002e25adbcf9143ae4

data/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ### master
 
+### v5.0.0, 2018-02-08
+- Remove `nginx_pass_ssl_client_cert` in favor of nginx_use_client_ssl
+- Add `nginx_server_ssl_ports` to specify which ports nginx should listen on
+- Remove `nginx_use_spdy`. Use `nginx_use_http2` instead.
+
 ### v4.2.0, 2018-02-08
 - Add support for client authentication using a root CA. Inspired by
   http://www.pandurang-waghulde.com/2014/06/client-side-ssl-certificate.html

data/lib/capistrano/tasks/nginx.rake

@@ -14,10 +14,19 @@ namespace :load do
     # ssl options
     set :nginx_location, '/etc/nginx'
     set :nginx_use_ssl, false
-    set :nginx_use_spdy, false
     set :nginx_use_http2, false
-    # if true, passes the SSL client certificate to the application server for consumption in Ruby code
-    set :nginx_pass_ssl_client_cert, false
+    # if true, verifies the client certificate, and passes a number of variables
+    # in the header to the application server consumption in Ruby code. These
+    # are:
+    # - X-Client-DN: the Distinguished Name of the certificate
+    # - X-Client-Serial: the Serial Number of the certificate
+    # - X-Client-Verify:
+    #   - SUCCESS if a certificate was supplied that was signed by the CA.
+    #   - FAILED if a certificate was supplied that was not signed by the CA.
+    #   - NONE if no certificate was supplied
+    # - X-Client-Raw-Cert: the raw (PEM) version of the supplied certificate
+    set :nginx_use_client_ssl, false
+    set :nginx_ssl_client_ca, '' # the location of the root CA (on server)
     set :nginx_ssl_cert, -> { nginx_default_ssl_cert_file_name }
     set :nginx_ssl_cert_key, -> { nginx_default_ssl_cert_key_file_name }
     set :nginx_ssl_cert_path, -> { nginx_default_ssl_cert_file_path }
@@ -33,11 +42,11 @@ namespace :load do
 end
 
 namespace :nginx do
-
   task :defaults do
     on roles :web do
       set :nginx_server_name, fetch(:nginx_server_name, host.to_s)
       set :nginx_server_port, fetch(:nginx_server_port, 80)
+      set :nginx_server_ssl_ports, fetch(:nginx_server_ssl_ports, [443])
     end
   end
 

data/lib/capistrano/unicorn_nginx/version.rb

@@ -1,5 +1,5 @@
 module Capistrano
   module UnicornNginx
-    VERSION = '4.2.0'.freeze
+    VERSION = '5.0.0'.freeze
   end
 end

data/lib/generators/capistrano/unicorn_nginx/templates/_default_server_directive.erb

@@ -1,24 +1,14 @@
-<% if fetch(:nginx_use_ssl) && nginx_pass_ssl_client_cert -%>
-# source: http://forum.nginx.org/read.php?2,236546,236596
-map $ssl_client_raw_cert $a {
-    "~^(-.*-\n)(?<1st>[^\n]+)\n((?<b>[^\n]+)\n)?((?<c>[^\n]+)\n)?((?<d>[^\n]+)\n)?((?<e>[^\n]+)\n)?((?<f>[^\n]+)\n)?((?<g>[^\n]+)\n)?((?<h>[^\n]+)\n)?((?<i>[^\n]+)\n)?((?<j>[^\n]+)\n)?((?<k>[^\n]+)\n)?((?<l>[^\n]+)\n)?((?<m>[^\n]+)\n)?((?<n>[^\n]+)\n)?((?<o>[^\n]+)\n)?((?<p>[^\n]+)\n)?((?<q>[^\n]+)\n)?((?<r>[^\n]+)\n)?((?<s>[^\n]+)\n)?((?<t>[^\n]+)\n)?((?<v>[^\n]+)\n)?((?<u>[^\n]+)\n)?((?<w>[^\n]+)\n)?((?<x>[^\n]+)\n)?((?<y>[^\n]+)\n)?((?<z>[^\n]+)\n)?(-.*-)$" $1st;
-}
-<% end -%>
-
 server {
 <% if fetch(:nginx_use_ssl) -%>
-    <% if fetch(:nginx_use_http2) -%>
-    listen <%= ssl_port %> http2;
-    <% elsif fetch(:nginx_use_spdy) -%>
-    listen <%= ssl_port %> spdy;
-    <% else -%>
-    listen <%= ssl_port %>;
+    <% fetch(:nginx_server_ssl_ports).each do |port| -%>
+      listen <%= port %> <%= 'http2' if fetch(:nginx_use_http2)-%>;
     <% end -%>
     ssl on;
     ssl_certificate <%= nginx_ssl_cert_file %>;
     ssl_certificate_key <%= nginx_ssl_cert_key_file %>;
     <% if fetch(:nginx_use_client_ssl) -%>
     ssl_trusted_certificate <%= nginx_ssl_client_ca %>;
+    ssl_verify_client optional_no_ca;
     <% end -%>
 
     ssl_session_cache shared:SSL:10m;
@@ -38,10 +28,6 @@ server {
 
   add_header X-Content-Type-Options nosniff;
 
-<% if fetch(:nginx_use_ssl) && (nginx_pass_ssl_client_cert || fetch(:nginx_use_client_ssl)) -%>
-    ssl_verify_client optional_no_ca;
-<% end -%>
-
     client_max_body_size 4G;
     keepalive_timeout 10;
 
@@ -66,11 +52,7 @@ server {
         proxy_set_header X-Client-Dn $ssl_client_s_dn;
         proxy_set_header X-Client-Serial $ssl_client_serial;
         proxy_set_header X-Client-Verify $ssl_client_verify;
-        <% end -%>
-
-        <% if fetch(:nginx_use_ssl) && nginx_pass_ssl_client_cert -%>
-        # source: http://forum.nginx.org/read.php?2,236546,236596
-        proxy_set_header X-Client-Cert $a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$t$v$u$w$x$y$z;
+        proxy_set_header X-Client-Raw-Cert $ssl_client_raw_cert;
         <% end -%>
 
         proxy_pass http://unicorn_<%= fetch(:nginx_config_name) %>;

data/lib/generators/capistrano/unicorn_nginx/templates/nginx_conf.erb

@@ -16,10 +16,4 @@ server {
 }
 <% end -%>
 
-<%# render the default server directive. If SSL is enabled, port 443 is used %>
-<%= template_to_s("_default_server_directive.erb", ssl_port: 443, nginx_pass_ssl_client_cert: false).to_s %>
-
-<% if fetch(:nginx_pass_ssl_client_cert) -%>
-<%# render the server directive with SSL client certificate authentication enabled on port 444 %>
-<%= template_to_s("_default_server_directive.erb", ssl_port: 444, nginx_pass_ssl_client_cert: true).to_s %>
-<% end -%>
+<%= template_to_s("_default_server_directive.erb").to_s %>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: capistrano-unicorn-nginx
 version: !ruby/object:Gem::Version
-  version: 4.2.0
+  version: 5.0.0
 platform: ruby
 authors:
 - Ruben Stranders